By integrating temporal graph construction, adversarial augmentation, and GCN classification, GraphGAN effectively models coordinated attack behaviors and mitigates class imbalance, providing a robust and topology-aware solution for intrusion detection in data-constrained environments.
Abstract
Distributed Denial-of-Service (DDoS) attacks threaten network availability, requiring a cognitive detection process that senses traffic, infers intent, and supports an adaptive response under severe class imbalance and non-stationary conditions. This paper proposes a Graph-based Generative Adversarial Network (GraphGAN) that serves as the cognitive detection engine for this task. GraphGAN captures the relational structure among traffic flows while addressing imbalance through adversarial generation of synthetic samples. Sequential flows are converted into $k$-nearest neighbor graphs using sliding windows to preserve feature-similarity and temporal dependencies among flows. The generator learns the distribution of DDoS attacks to synthesize realistic minority samples, while a Graph Convolutional Network (GCN)-based discriminator distinguishes real from synthetic graph data. A separate GCN classifier, trained on the balanced dataset, performs the final detection decision. Evaluations on four benchmark datasets show that GraphGAN achieves superior accuracy, precision, and recall compared to state-of-the-art approaches, particularly in data-scarce scenarios. By integrating temporal graph construction, adversarial augmentation, and GCN classification, GraphGAN effectively models coordinated attack behaviors and mitigates class imbalance, providing a robust and topology-aware solution for intrusion detection in data-constrained environments.
Cloud computing has emerged as an important core to the contemporary digital services, facilitating scalable, on demand provisioning of resources across a variety of application fields. Nevertheless, this multi-tenant and dynamic environment of clouds and the amplified attack surface make the detection of intrusions through reliable methods a consistent issue that cloud security systems struggle with. The proposed work is a Generative Adversarial Network (GAN)-based hardening framework of cloud intrusion detection systems, targeting better resilience to changing and low-rate cyberattacks. The methodology combines a conditional generator which is used to generate realistic cloud-specific attack traffic, a discriminator used to refine the adversarial traffic, as well as a co-trained intrusion classifier trained on both clean and synthetic data in a closed-loop way. The feature-aware regularization is introduced to maintain the statistical consistency of network traffic, and optimize the attack diversity. The proposed approach is proved to yield better results in comparison with signature-based, machine learning, deep learning, and adversarial ML-based IDS models by experimental assessment. Significant gains in the accuracy of identifying, the ability to recall, stability, and minimizing errors are also noticed with quantifiable increases observed in all evaluation measures. These findings represent the usefulness of adversarial data-driven learning to develop robust, adaptive, and future-ready cloud intrusion detection systems.
T. Divya, Sheik Saidhbi, S. Umarani et al.· 2026 International Conferenc...· 0 citations
Software Defined Networking (SDN) introduces centralized control mechanisms that improve network programmability and management; however, this architectural shift also exposes the control plane to critical security threats, particularly Distributed Denial of Service (DDoS) attacks. This paper presents a hybrid deep learning–based detection framework that integrates Convolutional Neural Networks (CNN) with Gated Recurrent Units (GRU) to enhance DDoS detection in SDN environments. The proposed CNN-GRU architecture combines spatial feature extraction with temporal traffic modeling to improve detection accuracy while maintaining practical inference latency. Experiments conducted using the CICIDS2018 dataset demonstrate that the proposed model achieves an overall classification accuracy of 99.98%, with precision and recall values exceeding 99.9% across both benign and attack traffic classes. The model records an average detection latency of approximately 219.8 ms per traffic instance, offering a favorable balance between detection performance and computational efficiency. Comparative evaluation against existing machine learning and deep learning approaches indicates that the proposed framework achieves competitive accuracy while maintaining deployment-oriented processing speeds. These results suggest that the CNN-GRU model is well-suited for SDN security monitoring under controlled experimental conditions.
Victor Anaga, B. Stephen, E. Adediji et al.· E3S Web of Conferences· 0 citations
Distributed Denial of Service (DDoS) attacks pose a significant threat to network availability, necessitating robust detection mechanisms. This paper investigates the efficacy of Long Short-Term Memory (LSTM) networks and Autoregressive Integrated Moving Average (ARIMA) models for distinguishing between benign and malicious DDoS traffic. Using the comprehensive CIC-IDS 2017 dataset, this study aims to evaluate and compare the predictive performance of these distinct modeling approaches. Our methodology involved preprocessing the CIC-IDS 2017 dataset, extracting relevant features, and performing feature engineering to create new, informative features for time-series analysis and classification. An LSTM neural network was meticulously designed and trained to capture intricate temporal patterns and dependencies in network traffic flows. Concurrently, an ARIMA model was developed to provide a statistical baseline, focusing on its capacity to model linear relationships. Experimental results demonstrated a significant performance disparity. The LSTM model achieved a remarkable accuracy of 99% in identifying DDoS attacks, showcasing its superior capability in discerning subtle anomalies. In contrast, the ARIMA model yielded an accuracy of 89%. This difference underscores the advantages of LSTM networks; their recurrent architecture excels at recognizing and learning from non-linear relationships and long-term dependencies prevalent in dynamic network traffic. While traditional statistical methods like ARIMA capture some temporal aspects, they are less adept at modeling complex, evolving cyber threats. This research highlights deep learning approaches, specifically LSTMs, as crucial for enhancing the precision and reliability of real-time DDoS attack detection, offering a more resilient defense against contemporary cyber threats.
Shaikh Al Harun, MD. Sumon Ahmed Rubel, Arithro Somodder et al.· International Conference on...· 0 citations
Among the most consequential vulnerabilities in contemporary IoT-based systems is the insider threat — a class of
attack in which authorised users deliberately or inadvertently misuse their privileges, often evading detection for prolonged
intervals. Mainstream detection approaches continue to be undermined by three unresolved obstacles: severe class imbalance
between benign and malicious records, the curse of dimensionality arising from rich feature sets, and the non-stationary nature
of user behavioural profiles. To address these co-occurring challenges within a unified architecture, this work proposes a graphstructured detection framework underpinned by a Graph Convolutional Network (GCN). Relational dependencies among users,
devices, and system resources are encoded as graph topology, enabling the model to capture interaction-driven threat indicators
that scalar feature vectors cannot represent. Improved Principal Component Analysis (IPCA) performs dimensionality reduction
while maximising the retention of discriminative variance. An Outlier-Resistant K-Means algorithm segments the activity space
into semantically coherent clusters, and the Enhanced Bidirectional Generative Adversarial Network (EBiGAN) synthesises
statistically faithful malicious samples to redress class skew. Hyperparameter optimisation is conducted via Bayesian search
guided by the Probability of Improvement (PI) acquisition function. On the CMU CERT benchmark, the proposed system
achieves a detection accuracy of 96.8%, a detection rate of 96.7%, and a false alarm rate of only 3%, outperforming all
compared baselines and demonstrating readiness for deployment in production IoT security environments.
Dr. M. Muni Babu, E. Divya, K. Bhavana et al.· International Journal for Re...· 0 citations
Distributed denial of service (DDoS) attacks continues to pose serious risks to modern networks, with their growing intensity making early detection both critical and challenging. Conventional machine learning (ML) models often struggle with the nonlinear and highly dynamic nature of attack traffic, which motivates the use of advanced architectures. In this study investigate a transformer-based classifier for DDoS detection on the CIC-DDoS2019 dataset. The workflow included preprocessing, feature scaling, and domain-guided feature selection. Logistic regression (LR) was employed as a baseline, achieving 92.1% accuracy and F1-score of 0.90, thereby revealing the limitations of linear models. The transformer, after hyperparameter tuning and 5-fold cross-validation, reached an average accuracy of 99.95% with precision, recall, and F1-scores all above 99.9%. The model demonstrated stable convergence and generalization across folds. These results highlight the strength of attention mechanisms in capturing feature dependencies, while also pointing to future directions such as real-time deployment, explainability, and resilience to zero-day attacks.
Lokeshwaran Kanagaraj, Raguraman Purushothaman, Sathya Subramanian et al.· IAES International Journal o...· 0 citations
Evasion attacks deliberately manipulate input to an ML-based system to produce an incorrect prediction while the manipulated input still appears benign. The PANDA framework has demonstrated that adversarial examples developed for the vision domain can be transferred to the network domain by converting packet sequences into invertible grayscale images, enabling gradient-based attacks such as masked FGSM against autoencoder-based network intrusion detection systems (NIDS). These attacks manipulate the NIDS anomaly score without altering the underlying attack semantics, leaving defenders without a straightforward way to distinguish between benign flows and carefully perturbed malicious traffic. In this paper, we propose two complementary detectors: the Residual Localisation Detector (RLD), which tracks the spatial concentration of reconstruction errors in the inter-arrival time feature region in image space; and the Feature-Space Perturbation Consistency (FPC) Detector, which operates directly on packet-level inter-arrival time features in packet-feature space. We evaluate both detectors on benign, malicious, and adversarial traffic from multiple IoT devices in the UQ-IoT dataset. Both detectors achieve near-perfect detection performance (TNR, TPR, precision, recall, and F1-score $\geq 0.99$) against adversarial examples across the evaluated IoT traffic. Our results indicate that integrating reconstruction-based scoring with perturbation consistency checks, in both image space and packet-feature space, offers a practical defence against emerging PANDA-style adversarial attacks on NIDS.